1. Data Controller
Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by HBY Software (the “Company”) as data controller, within the scope described below. OnionZero is a software protection and licensing system developed by HBY Software.
You can reach the data controller via the contact form or by e-mail at destek@onionzero.com.
2. Personal Data We Process
The following categories of data are processed across our website, management panel and licensing infrastructure:
| Category | Scope | Source |
|---|---|---|
| Contact form data | Name, e-mail address, subject and message content | You filling in the contact form |
| Security records | IP address on form submissions (abuse prevention and rate limiting) | Collected automatically on submission |
| Customer and licence data | Company/title, authorised e-mail address, licence records and activation history | Licence purchase and activation processes |
| Technical telemetry | Encryption-layer installation signals: licence ID, product version, PHP and operating-system version, anonymised machine digest | Installed software components, automatically |
Machine fingerprint data is stored only as a cryptographic digest (hash); directly identifying raw values such as machine names are not stored and are never displayed in our interfaces.
3. Purposes and Legal Grounds
Your personal data is processed on the following legal grounds under Article 5(2) of the KVKK:
| Purpose | Legal ground |
|---|---|
| Receiving and answering your contact requests | Legitimate interest (Art. 5/2-f) |
| Establishing the licence agreement, generating licence files and managing your account | Establishment or performance of a contract (Art. 5/2-c) |
| Running activation, licence verification and update-delivery processes | Performance of a contract (Art. 5/2-c) |
| Invoicing and accounting records | Compliance with a legal obligation (Art. 5/2-ç) |
| Service security, prevention of abuse and licence violations | Legitimate interest (Art. 5/2-f) |
Where a processing activity requires explicit consent, your consent is obtained separately. Our site does not run consent-based marketing messages or behavioural tracking.
4. Transfers of Personal Data
Your data may be shared with our hosting and e-mail infrastructure providers only to the extent required to deliver the service. Beyond that, your personal data is never sold, rented or shared with third parties for marketing purposes. Transfers abroad occur only when necessary and with the safeguards foreseen in Article 9 of the KVKK.
5. Retention Periods
- Contact form messages: at most 24 months after your request is resolved.
- Licence and customer records: for the duration of the contractual relationship; after termination, at least 10 years for accounting records as required by the Turkish Commercial Code and tax legislation.
- Technical security records and telemetry digests: at most 24 months; then deleted or anonymised.
6. Your Rights (KVKK Article 11)
Under Article 11 of the KVKK you have the right to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties to whom data is transferred at home or abroad,
- Request the correction of incompletely or inaccurately processed data,
- Request deletion or destruction within the conditions of Article 7,
- Request that correction, deletion and destruction operations be notified to third parties to whom the data was transferred,
- Object to a result arising against you through analysis exclusively by automated systems,
- Claim compensation for damage arising from unlawful processing.
7. How to Apply
You may exercise your rights by sending an e-mail containing information that allows us to verify your identity to destek@onionzero.com. Requests are answered free of charge as soon as possible and within thirty days at the latest; if the response requires additional cost, the fee set by the Turkish Personal Data Protection Board may be charged.
8. Security Measures
To protect your personal data we apply technical and organisational measures including TLS encryption in transit, irreversible cryptographic hashing of panel passwords, encrypted storage of secret keys, role-based access control and monitoring of security event logs.